Can't seem to get a <script> to run when added to the allowlist?

[chrismahon]

I'm trying to allow for a <script> tag to run as it would normally if you were to include it in a HTML file. I know the security concerns associated with this, but there is a specific use case the markdown editor has that requires us to be able to include <script> tags.

I have the following code example:

  def render
    pipeline = HTMLPipeline.new \
      convert_filter: HTMLPipeline::ConvertFilter::MarkdownFilter.new,
      sanitization_config: sanitization_config
    result = pipeline.call("<script>console.log(1)</script>")
    result[:output].html_safe
  end
  
  def sanitization_config
    config = HTMLPipeline::SanitizationFilter::DEFAULT_CONFIG.deep_dup
    config[:elements] << "script"
    config
  end

Is there something I am missing with the sanitisation_config so the console.log(1) fires correctly in the dev console?

[gjtorikian]

I think I might know what's going on: the MarkdownFilter has its own sanitization process.

Could you let me know if this works?

    pipeline = HTMLPipeline.new \
      convert_filter: HTMLPipeline::ConvertFilter::MarkdownFilter.new,
      sanitization_config: sanitization_config
    result = pipeline.call("<script>console.log(1)</script>", context: { markdown: { render: { unsafe: true } } })

If this does fix it, short of additional documentation, I'm not sure how best to resolve this. Would one expect the addition of "unsafe" elements in the sanitization to always permit unsafe elements throughout the pipeline? I'm not sure.

[gjtorikian]

waiting to hear back